aquasecurity/tfsec
Tfsec
tfsec is a static analysis tool and infrastructure as code linter designed to detect security misconfigurations and compliance violations in Terraform infrastructure code. It functions as a cloud security posture tool and policy enforcement engine that evaluates configurations against established security benchmarks.
The tool provides multi-cloud security auditing for providers including AWS, Azure, Google Cloud, and Kubernetes, as well as specialized scanning for DigitalOcean, OpenStack, CloudStack, and GitHub configurations. It identifies insecure settings such as public access or unencrypted storage across compute, networking, and identity services.
The engine includes capabilities for complex expression evaluation to resolve functional expressions and resource relationships, ensuring misconfigurations are detected beyond literal string values. It supports custom policy definitions for organization-specific standards and allows for security warning suppression via source code comments or command-line flags.
The scanner is designed for CI/CD security integration as a standalone binary or container, with the ability to export findings in structured formats such as JSON, SARIF, and CSV.
Features
- Infrastructure as Code Security - Provides automated security scanning and misconfiguration detection for infrastructure-as-code configuration files.
- Static Analysis Engines - Analyzes infrastructure code by parsing resource blocks and attributes to identify security vulnerabilities and misconfigurations.
- Terraform Analyzers - Performs static analysis specifically on Terraform configuration files to identify security misconfigurations.
- Misconfiguration Detectors - Identifies insecure settings such as public access or unencrypted storage within cloud compute and networking definitions.
- Unified Resource Models - Maps diverse cloud resource definitions from different providers into a unified format for consistent security scanning.
- Configuration Expression Resolvers - Resolves complex functional expressions to evaluate actual security settings instead of relying on literal strings.
- Infrastructure as Code Scanners - Analyzes infrastructure templates to identify insecure settings before they are deployed to production.
- JSON-Based Rule Engines - Evaluates resource configurations against security benchmarks using a predefined set of rules.
- Misconfiguration Scanning - Detects known security flaws and structural misconfigurations across cloud infrastructure definitions.
- Policy Enforcement Engines - Evaluates infrastructure configurations against defined security and compliance rules to enforce standards.
- Cloud Security Posture Scanners - Evaluates cloud configurations against established security benchmarks to detect risks and misconfigurations.
- Static Expression Evaluation - Resolves functional expressions and resource relationships to detect misconfigurations beyond literal string values.
- Google Cloud Resource Audits - Detects security misconfigurations across identity, networking, storage, and compute resources in Google Cloud.
- CI/CD Pipeline Integrations - Automates security checks within CI/CD pipelines as a standalone binary or container.
- Cloud Auditing Tools - Audits infrastructure templates across AWS, Azure, and GCP to identify common security gaps.
- Infrastructure Policy Definition - Enforces organization-specific infrastructure standards through tailored security checks defined in configuration files.
- Azure Misconfiguration Detectors - Identifies security vulnerabilities across compute, networking, and storage services by scanning Azure infrastructure code.
- GitHub Configuration Audits - Identifies security misconfigurations in GitHub repository settings, branch protections, and automation workflows.
- DigitalOcean Configuration Audits - Analyzes DigitalOcean compute and storage configurations for security misconfigurations.
- AWS - Performs automated security checks of Amazon Web Services resource settings and access controls.
- Kubernetes Posture Scanning - Analyzes Kubernetes service definitions to detect insecure network settings and misconfigurations.
- Workflow Automation - Static analysis for security.
- Workflow Utilities - Static analysis tool for security misconfigurations.
Star history
How this analysis was created: This summary and feature list were written by an AI model that read the project's README and public documentation pages. Each feature links to the documentation it came from; stars, license and language come straight from the GitHub API. The model does not read the source code, and the analysis is refreshed when the project is re-analysed. Learn more on our About page.
